{
    "id": "SemperisDSP",
    "title": "Semperis Directory Services Protector",
    "publisher": "SEMPERIS",
    "descriptionMarkdown": "Semperis Directory Services Protector data connector allows for the export of its Windows event logs (i.e. Indicators of Exposure and Indicators of Compromise) to Microsoft Sentinel in real time.\nIt provides a data parser to manipulate the Windows event logs more easily. The different workbooks ease your Active Directory security monitoring and provide different ways to visualize the data. The analytic templates allow to automate responses regarding different events, exposures, or attacks.",
    "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**dsp_parser**](https://aka.ms/sentinel-SemperisDSP-parser) which is deployed with the Microsoft Sentinel Solution.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "Semperis-DSP-Security",
            "baseQuery": "dsp_parser"
        }
    ],
    "sampleQueries": [
        {
            "description" : "Get all Indicators of Exposure (IoEs) failed alerts for the last hour",
            "query": "dsp_parser\n | where EventID == 9212\n | where TimeGenerated >= ago(1h)\n | summarize count() by TimeGenerated, tostring(ForestName), tostring(Domains), tostring(SecurityIndicatorName), tostring(SecurityIndicatorDescription), tostring(ResultMessage), tostring(SecurityFrameworkTags), tostring(LikelihoodOfCompromise), tostring(FirstFound), tostring(Remediation), tostring(Score)"
        },
        {
            "description" : "Get Indicators of Exposure (IoEs) failed alerts for the last 24 hours",
            "query": "dsp_parser\n | where EventID == 9212\n | where TimeGenerated >= ago(24h)\n | summarize count() by TimeGenerated, tostring(ForestName), tostring(Domains), tostring(SecurityIndicatorName), tostring(SecurityIndicatorDescription), tostring(ResultMessage), tostring(SecurityFrameworkTags), tostring(LikelihoodOfCompromise), tostring(FirstFound), tostring(Remediation), tostring(Score)"
        },
        {
            "description" : "Get all Indicators of Exposure (IoEs) failed alerts for the last 7 days",
            "query": "dsp_parser\n | where EventID == 9212\n | where TimeGenerated >= ago(7d)\n | summarize count() by TimeGenerated, tostring(ForestName), tostring(Domains), tostring(SecurityIndicatorName), tostring(SecurityIndicatorDescription), tostring(ResultMessage), tostring(SecurityFrameworkTags), tostring(LikelihoodOfCompromise), tostring(FirstFound), tostring(Remediation), tostring(Score)"
        },
        {
            "description" : "Get all Indicators of Exposure (IoEs) tested and passed for the last hour",
            "query": "dsp_parser\n | where EventID == 9211\n | where TimeGenerated >= ago(1h)\n | summarize count() by TimeGenerated, tostring(ForestName), tostring(Domains), tostring(SecurityIndicatorName), tostring(SecurityIndicatorDescription), tostring(ResultMessage), tostring(SecurityFrameworkTags), tostring(LikelihoodOfCompromise), tostring(Score)"
        },
        {
            "description" : "Get all Indicators of Exposure (IoEs) tested and passed for the last 24 hours",
            "query": "dsp_parser\n | where EventID == 9211\n | where TimeGenerated >= ago(24h)\n | summarize count() by TimeGenerated, tostring(ForestName), tostring(Domains), tostring(SecurityIndicatorName), tostring(SecurityIndicatorDescription), tostring(ResultMessage), tostring(SecurityFrameworkTags), tostring(LikelihoodOfCompromise), tostring(Score)"
        },
        {
            "description" : "Get all Indicators of Exposure (IoEs) tested and passed for the last 7 days",
            "query": "dsp_parser\n | where EventID == 9211\n | where TimeGenerated >= ago(7d)\n | summarize count() by TimeGenerated, tostring(ForestName), tostring(Domains), tostring(SecurityIndicatorName), tostring(SecurityIndicatorDescription), tostring(ResultMessage), tostring(SecurityFrameworkTags), tostring(LikelihoodOfCompromise), tostring(Score)"
        }
    ],
    "dataTypes": [
        {
            "name": "Event (Semperis-DSP-Security)",
            "lastDataReceivedQuery": "dsp_parser\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "dsp_parser\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "", 
            "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**dsp_parser**](https://aka.ms/sentinel-SemperisDSP-parser) which is deployed with the Microsoft Sentinel Solution.",
            "instructions": [  
            ]    
        }, 
        {
            "title": "**Configure Windows Security Events via AMA connector**",
            "description": "Collect Windows security events logs from your **Semperis DSP Management Server** ."
        },
        {
            "title": "1. Install the Azure Monitor Agent (AMA)",
            "description": "On your **Semperis DSP Management Server** install the AMA on the DSP machine that will act as the event log forwarder.\nYou can skip this step if you have already installed the Microsoft agent for Windows"
        },
        {
            "title": "2. Create a Data Collection Rule (DCR)",
            "description": "Start collecting logs from the **Semperis DSP Management Server** .\n\n1. In the Azure portal, navigate to your **Log Analytics workspace**.\n2. In the left pane, click on **Configuration** and then **Data connectors**.\n3. Find and install the **the Windows Security Events via AMA** connector.\n4. Click on **Open connector** and then on **Create data collection rule**.\n5. Configure the DCR with the necessary details, such as the log sources and the destination workspace.",
            "instructions": [
                {
                    "parameters": {
                        "title": "Choose where to install the agent:",
                        "instructionSteps": [
                            {
                                "title": "Install agent on Semperis DSP Management Server",
                                "description": "Download the agent on the relevant machine and follow the instructions.",
                                "instructions": [
                                    {
                                        "parameters": {
                                            "linkType": "InstallAgentOnNonAzure"
                                        },
                                        "type": "InstallAgent"
                                    }
                                ]
                            }
                        ]
                    },
                    "type": "InstructionStepsGroup"
                }
            ]
        },
        {
            "title": "**Configure Common Event Format via AMA connector**",
            "description": "Collect syslog messages send from your **Semperis DSP Management Server** ."
        },
        {
            "title": "1. Install the Azure Monitor Agent (AMA)",
            "description": "Install the AMA on the Linux machine that will act as the log forwarder. This machine will collect and forward CEF logs to Microsoft Sentinel.\nYou can skip this step if you have already installed the Microsoft agent for Linux"
        },
        {
            "title": "2. Create a Data Collection Rule (DCR)",
            "description": "Start collecting logs from the **Semperis DSP Management Server** .\n\n1. In the Azure portal, navigate to your **Log Analytics workspace**.\n2. In the left pane, click on **Configuration** and then **Data connectors**.\n3. Find and install the **the Common Event Format via AMA** connector.\n4. Click on **Open connector** and then on **Create data collection rule**.\n5. Configure the DCR with the necessary details, such as the log sources and the destination workspace.",
            "instructions": [
                {
                    "parameters": {
                        "title": "Choose where to install the agent:",
                        "instructionSteps": [
                            {
                                "title": "Install agent on Semperis DSP Management Server",
                                "description": "Download the agent on the relevant machine and follow the instructions.",
                                "instructions": [
                                    {
                                        "parameters": {
                                            "linkType": "InstallAgentOnNonAzure"
                                        },
                                        "type": "InstallAgent"
                                    }
                                ]
                            }
                        ]
                    },
                    "type": "InstructionStepsGroup"
                }
            ]
        },
        {
            "title": "3. Configure sending CEF logs on your Semperis DSP Management Server",
            "description": "Configure your **Semperis DSP Management Server** to send CEF logs to the Linux machine where the AMA is installed. This involves setting the destination IP address and port for the CEF logs"
        },
        {
            "title": "",
            "description": "> You should now be able to receive logs in the *Windows event log* table and *common log* table, log data can be parsed using the **dsp_parser()** function, used by all query samples, workbooks and analytic templates."
        }
    ],
    "metadata": {
        "id": "TBD",
        "version": "1.0.0",
        "kind": "dataConnector",
        "source": {
            "kind": "community"
        },
        "author": {
            "name": "Semperis"
        },
        "support": {
            "name": "Semperis",
            "link": "https://www.semperis.com/contact-us/",
            "tier": "developer"
        }
    }
}